From db139e6800b53bcfd970c83bce56884ac8368bd8 Mon Sep 17 00:00:00 2001 From: Mikhail Date: Mon, 31 Aug 2026 13:22:23 +0300 Subject: [PATCH] docs(secrets): record provisioning evidence --- ...ecrets-001-local-provisioning-2026-08-31.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/docs/evidence/gen2-secrets-001-local-provisioning-2026-08-31.md b/docs/evidence/gen2-secrets-001-local-provisioning-2026-08-31.md index 987c8cf..a82a052 100644 --- a/docs/evidence/gen2-secrets-001-local-provisioning-2026-08-31.md +++ b/docs/evidence/gen2-secrets-001-local-provisioning-2026-08-31.md @@ -33,3 +33,21 @@ The following checks completed successfully before production execution: No credential value, fingerprint, length, header, or plaintext environment value was read, printed, copied, committed, or included in this evidence. + +## Production control-plane evidence + +The one-shot provisioner was run from a detached `gen2-integration` worktree +on `docker.cin.su`. It created the dedicated external volume and provisioned +the credential once. A repeat `ensure` reported that the already active +artifact was reused. A bounded owner-requested rotation then completed. + +For creation, idempotent ensure, and rotation, the stable Core, Commit, +Creator Web, Cognitive Worker, and Research Runtime container identities were +recorded before and after the one-shot operation and were unchanged. The +verification checked only artifact and separate metadata/audit file presence; +it did not read their content. + +At this point the credential is provisioned but not yet used by the stable +runtime. Consumer mount and service-authentication acceptance are completed +only when `GEN2-AUTHORITY-001` is merged and deployed as its own controlled +candidate ReleaseSet.